Investigation Report D2/2011L

Airliner Engine Bleed Air System Failure: Serious Incident on a Scheduled Flight on 5 March 2011 OH-LXL

Airbus A320-214

According to Annex 13 to the Convention on International Civil Aviation, paragraph 3.1, the sole objective of the investigation of an accident or incident shall be the prevention of accidents and incidents. It is not the purpose of this activity to apportion blame or liability. This basic rule is also contained in the Safety Investigation Act (525/2011) and European Union Regulation No 996/2010. Use of the report for reasons other than improvement of safety should be avoided.

2

INVESTIGATION REPORT: D2/2011L INVESTIGATORS: Vesa Palm, INVESTIGATION COMPLETED ON: 17 January 2013 Markku Loikkanen, Pertti Kalttonen Time: 5 March 2011 at 06:50 UTC

Place: At flight level 360, north of the Island of Öland in the airspace of southern Sweden.

Type of aircraft: A320-214

Registration: OH-LXL, flight number AY831 with callsign FIN831L

Powerplants: 2 x CFM56-5B4

Year of manufacture: 2003

Type of flight: Scheduled flight

Damage to aircraft: No damage

Number of persons onboard: 6 members of the aircrew and 140 passengers

Pilot: Pilot-in-command: 44 years

Co-pilot: 32 years

Licences: Airline Transport Pilot’s Licence, valid until 7 April 2013. All required ratings were valid.

Commercial Pilot Licence, valid until 13 June 2015. All required ratings were valid.

Flight experience: Total flight hours: 15 786 h Flight hours on this type: 5796 h

Total flight hours: 4209 h Flight hours on this type: 3548 h

Meteorological information: Meteorological information was obtained from the briefing information on the flight deck.

The waypoint nearest to the occurrence was NISIX; FL390 P007 304 / 069 -50 M032 FL350 P005 305 / 077 -49 M034 FL260 M010 307 / 071 -46 M030 Waypoint SVD; FL390 M010 315 / 081 -66 M012 FL350 M007 315 / 091 -61 M013 FL260 M004 311 / 087 -41 M019 The aircraft was between the abovementioned waypoints at the time of the occurrence, heading towards SVD. The investigators also analysed the radio-soundings and temperature charts from the locations nearest to the occurrence. Even though the flight was proceeding towards a rapidly cooling air mass, this was not considered to have directly contributed to the occurrence.

Translation: R&J Language Service

3

SYNOPSIS

On 5 March 2011 at approximately 06:50 a pressurisation failure led to a serious incident on Finnair flight AY831. An Airbus A320-214 airliner, registration OH-LXL with call sign FIN831L, was on a scheduled flight from Helsinki to London. The aircraft departed with Bleed No1 inoperative according to Minumum Equipment List (MEL 36-11-01).The aircraft was flying in Swedish airspace, north of the Island of Öland at Flight Level (FL) 360 (ca. 10950 m) with both air conditioning packs supplied by Bleed No2 and cross bleed valve opened. 10 minutes after reaching cruise altitude, the remaining bleed (Bleed No2) failed. As a result of this, the flight crew had to execute a descent rapidly to a safe altitude.

The Safety Investigation Authority, Finland (SIA) was informed of the occurrence when both the captain of the flight and the air traffic controller at Malmö Air Traffic Control Centre (ATCC) filed their respective Air Safety Reports.

On 11 March 2011, SIA appointed commission D2/2011L to investigate this incident. Investigators Vesa Palm, Markku Loikkanen and Niina Aintila were appointed to the investigation commission. On 7 November 2011 Niina Aintila was released from the duties of expert to the investigation commission and was replaced by Pertti Kalttonen.

On 11 March 2011, SIA sent notifications to the International Civil Aviation Organization (ICAO), the European Commission, the European Aviation Safety Agency (EASA), the UK Air Accident Investigation Branch (AAIB), the Swedish Accident Investigation Authority (Statens haverikommission - SHK) and the French air accident investigation authority (Bureau d’Enquêtes et d’Analyses pour la Sécurité de l’Aviation Civile - BEA). On 11 March BEA designated Emmanuel Delbarre as their accredited representative to the investigation.

The investigation report was sent for comments to parties concerned, Finnair Plc, Airbus S.A.S., Finnish Transportation Safety Agency Trafi, BEA, EASA and SHK. The comments from the parties in question were received until 13 December 2012. Summary of the comments is presented in Appendix 1 of this report.

All times in this investigation report are in Coordinated Universal Time (UTC). Finnish local time is UTC + 2 h.

The Finnish language version of the report is the official document. The Finnish investigation report and the material used in the investigation are stored at Safety Investigation Authority, Finland.

4

1 FACTUAL INFORMATION

1.1 History of the flight

1.1.1 Events before the flight

On the basis of flight crew interviews both pilots were alert and fit to fly. The co-pilot came to work as per his work schedule and the captain was called from standby duty. The captain was summoned to the flight at the last minute and so could not report for duty within the normal time frame. Hence, the co-pilot was charged with the flight briefing. Nonetheless, the captain called the co-pilot on his way to work and received the required meteorological information. Among other things, they agreed on the needed amount of fuel. The captain made it to the cockpit before the scheduled time of departure and, consequently, the flight was not delayed.

1.1.2 Actions before departure with a partly inoperative aircraft

During the flight briefing the co-pilot, as per normal routine, checked the airworthiness of the aircraft as well as its operative restrictions. Due to a prior malfunction the left engine's bleed air system was inoperative for flight. Even so, it was permissible to carry out the flight with this functional restriction in accordance with the so-called Deferred Defect procedure. According to this practice the maintenance organisation transfers the fault to the Hold Item List (HIL), meeting the manufacturer-defined Minimum Equipment List (MEL) requirements. Ultimately, it was the responsibility of the pilot-in-command to pronounce the aircraft airworthy for the occurrence flight.

The co-pilot of the flight checked the Deferred Defect requirements from the MEL. According to it, it was permissible to fly the aircraft for ten days with one engine bleed air system out of service. Up until that point in time the aircraft had already flown for seven days with this technical limitation. The previous flights had been uneventful. According to the Finnair Technical Services (FTS) fault tracking, corrective action had been performed on the engine's bleed air system, albeit to no avail. The fault did not impose any actual functional restrictions for this flight. Regarding the fault, the MEL provided the flight crew with operative instructions for preventive action prior to the flight as well as actions to take during the flight.

1.1.2.1 Aircraft Monitoring System functions in certain failures

If the other engine's bleed air system is already inoperative prior to the flight, the Electronic Centralized Aircraft Monitoring (ECAM) system, by its design, will not read the failure of the remaining operative bleed air system as a Dual Bleed Fault. This being the case, Airbus S.A.S. published the Operations Engineering Bulletin (OEB) Ref. 203/1 MAR 10 for the A320 fleet. The Bulletin is presented in Appendix 2 of this report. OEB 203 provides instructions for the situation in which a first engine bleed air system becomes unavailable. The purpose of this OEB is to avoid the second bleed loss by reducing proactively the bleed air demand as soon as the first engine bleed has been already lost. The action reduces stress on the single remaining operative system so as to avert a loss of pressurization in flight. Should this however occur, the flight crew must first complete the ECAM actions. Secondly Quick Reference Handbook, QRH 2.02 provides the pertinent emergency/abnormal procedure for the flight crew to be followed. In a Dual Bleed Fault situation the flight crew must immediately reduce altitude. Extract from the QRH is presented in Appendix 3 of this report. The situation calls for a so-

5

called emergency descent to a safe altitude when the cabin pressure altitude warning is given, at the very latest.

At the time of the event, the Airbus MMEL was erroneously referring, for crew awareness, to the OEB 203 in case of second bleed loss.

1.1.3 The incident flight

The scheduled Finnair flight AY831 departed Helsinki for London on 5 March 2011 at 06:02. It was dispatched with Bleed No1 inoperative as per operator MEL 36-11-01a.The co-pilot was the Pilot Flying (PF) and the captain the Pilot Non Flying (PNF). There were no other persons on the flight deck during the flight.

After having flown for 48 minutes the aircraft was approximately 45 km north of Öland, cruising at FL 360 over the Baltic Sea. At that time the flight crew noticed that the right engine's Bleed No2 pressure and cabin pressure altitude fluctuated. A little after this the ECAM annunciated an AIR ENG 2 BLEED FAULT warning. The bleed air temperature of the right engine had exceeded its maximum permissible value (257 ºC). As a result of this, the system shut down and the cabin pressure altitude slowly began to climb. The bleed air needed for cabin pressurisation was no longer available and, therefore, the flight crew had to immediately initiate a descent to a safe altitude.

The captain decided to take over the controls and the co-pilot began to read the emergency/abnormal checklists related to the fault. The captain did not deem it necessary to squawk 7700 (emergency) on the radar transponder as they were already maintaining continuous contact with the air traffic control.

Immediately following the occurrence the flight crew requested Malmö ATCC to clear them to a lower flight level. As soon as they received the clearance they commenced the descent. As the situation progressed the ECAM annunciated an excessive cabin altitude pressure warning 9450 ft (ca. 2880 m). The class of this warning requires immediate attention. It illuminates a red warning light in both pilots' field of view, coupled with a continuous aural warning. The pilot acknowledges the warning by pushing the master warning push-button. The ECAM continues to display the related red emergency checklist for pilot actions. In this case the checklist required the crew to initiate an immediate emergency descent. As per the instructions, the flight crew donned their emergency oxygen masks and the captain steepened the nose down attitude by extending the speed brakes, so as to increase the vertical speed of the aircraft. The air traffic control cleared flight AY831 to FL 100 (ca. 3050 m) which is the maximum recommended altitude for unpressurised cabins. The ATC provided their clearances to lower flight levels in such a manner that the aircraft did not have to level out at any stage of the descent. The aircraft momentarily, and slightly, exceeded its maximum air speed during the descent. There was no high terrain or, in this case, any other flight activity below the planned route.

During the descent, the crew successfully reset Bleed No2, although PACK 1 was not set to OFF as instructed by the applicable QRH 2.02. Once the bleed air temperature cooled to its standard level, cabin pressurisation returned to normal. Since the engine's bleed air temperature remained within its normal limits, the captain levelled out the emergency descent at FL 140. Seeing that the engine bleed air system continued to function normally and there was sufficient fuel to take them all the way to London, the flight crew decided to continue the flight to their destination at a lower flight level, FL 250 (ca. 7600 m). The flight crew kept a close eye on bleed air system temperatures. The Auxiliary Power Unit (APU) was not started. Despite the completed action the bleed air

6

temperature, again, climbed very close to its maximum permissible value for the last 20 minutes of the cruise phase.

The flight crew kept the cabin crew and the passengers informed of the events. At no stage of the occurrence were the passengers at risk, nor did the automatic pressure control deploy the passenger oxygen masks in the cabin.

The Cockpit Voice Recorder was stopped after landing in London at 09:03.

1.2 Tests and research

1.2.1 Functional description of the engine bleed air system

The bleed air system in the Airbus A320-214 aircraft provides bleed air, among other things, for cabin pressurisation as well as anti-icing for the wings and engines. Normally, the bleed air system operates automatically.

Figure1. General layout of the bleed air system

The bleed air systems are controlled and monitored by Bleed Monitoring Computers (BMC), one per each system. The BMCs record the events that occur during system operation. This is a feature which is especially designed for post-flight troubleshooting. The flight crew can monitor the bleed air system status on their System Display (SD).

The Fan Air Valve (FAV) controls the bleed air temperature by adjusting the volume of air passing through the Pre-cooler Exchanger (PCE). In an overheat situation Temperature Limitation Thermostat (TLT) may command the Pressure Regulating Valve (PRV) to close, in which case the ECAM annunciates an AIR ENG 1/2 BLEED FAULT warning.

Subject to certain operational conditions it is possible to turn off the bleed air system on either engine prior to the flight. In such a case, only one system will provide bleed air. On the occurrence flight the left engine's bleed air system was inoperative for flight in accordance with the procedure, valid at the time. The pilots were aware of the fact that they needed to pay special attention to the operative system.

7

When necessary, it is possible to obtain bleed air from the APU up until FL 200 (ca. 6100 m). In that case the flight crew has to separately start the APU and select its bleed air supply. The APU can be started at any altitude and its bleed air system operates independently of the engines' bleed air systems.

1.2.2 Technical maintenance

Five separate engine bleed air system modifications had been published prior to the occurrence flight. In 2008 Finnair launched a campaign to implement the modification programme. The modifications were to be carried out when the components had to be removed for repairs. When it comes to the OH-LXL, six of the ten modifications (5 mods per engine) had been completed. As a result of this incident the modification work schedule was expedited.

The aircraft's maintenance cycles are based on the manufacturer's maintenance programme which was appropriately followed. An inspection carried out by the maintenance organisation revealed that the Fan Air Valve (FAV) had failed. In addition, the Temp Limitation Thermostat (TLT) and the Temp Control Thermostat (TCT) as well as the Over Pressure Valve (OPV) and the Pressure Regulating Valve (PRV) were replaced. During their replacement it was discovered that the components were extremely dirty. All replaced components were tested during the shop visit by the component manufacturer (Liebherr-Airspace) and it was found out that the parts were out of operating limits.

1.2.3 Flight recorders

The Solid State Flight Data Recorder (SSFDR) and the Solid State Cockpit Voice Recorder (SSCVR) are located in the empennage structure. They are fully electronic, devoid of any moving parts. Regarding them, this investigation report uses the terms Flight Data Recorder (FDR) and Cockpit Voice Recorder (CVR). The capacity of the FDR is 25 hours and that of the CVR 2 hours.

Both recorders were in good shape and functioned normally. The CVR begins to record from the first engine start-up and it automatically stops after five minutes from the last engine's shutdown.

The investigation commission supervised the downloading of the recorded information carried out at the maintenance premises, and analysed the data therein. The FDR contained all data from the occurrence flight. The CVR did not contain the information from the time of the occurrence because the remaining flight time had exceeded the two hour recording capacity.

1.2.4 Radiotelephony

The recorded radiocommunications between Malmö ATCC and the aircraft reveal that the flight crew informed the air traffic control of the in-flight depressurisation. Upon request, they were first cleared to descend to FL 300 (ca. 9100 m), and then re-cleared to FL 200 (ca. 6000 m). When the traffic situation so permitted the ATCC cleared flight AY831 to descend to FL 100, a safe altitude. The captain did not declare an emergency.

During the descent the flight crew noticed that the bleed air system was again functioning and informed the ATC that they would level out at FL 140. A moment after this they requested a clearance to FL 160 so as to fly on top, clear of the clouds. Once

8

the flight crew regained control of the situation they continued the flight to London at FL 250.

When the situation calmed down Malmö ATCC requested more detailed information about the fault. The flight crew explained the nature of the fault to the ATC as well as their assessment regarding the severity of the situation. The ATCC was also told that since the cabin emergency oxygen masks had not deployed, the captain did not deem this to be an emergency. The flight crew said that they would file an Aviation Safety Report (ASR). Malmö ATCC replied that they would do likewise.

9

2 ANALYSIS

2.1 Flight crew action

2.1.1 Flight briefing

During the flight briefing the co-pilot made a computer printout which contained all of the essential briefing information. In addition he printed the so-called e-Log which included the information regarding the technical condition of the OH-LXL. It was at this stage the co-pilot learned that the other bleed air system had been turned off, although listed under the wrong title. The information referred to the appropriate section in the MEL which advises the flight crew to complete the required action to minimise the stress on the operative system. The operational procedure of MEL 36-11 refers to the OEB 203 in its paragraph “Cockpit preparation”. This OEB procedure, still, contains actions to be completed in case of a first bleed loss in flight, not during Cockpit preparation. During the co-pilot’s interview he said that he completed all required actions in the procedure. It is the responsibility of the captain to double-check that the correct actions have been completed. The investigators believe that the segregation of the actions prior to the flight and during the flight is not clear enough. The MEL should contain a procedure to be followed before engine start. During the investigation Airbus informed that they will modify the MMEL 36-11-01 operational procedure (target date 1 Q 2013) to detail the crew actions without referring to the OEB. Apparently, the captain only learned of the aircraft's bleed air system limitation when he belatedly arrived at the cockpit.

2.1.2 The incident flight

When operating on only one engine's bleed air system the MEL advises that the flight crew either turn off both air conditioning units (PACKS) or use APU bleed air during take-off. FDR records indicate that take-off was performed with PACKS OFF (FCVs = 0) in accordance with the MEL instructions.

The aircraft manufacturer’s A320 Quick Reference Handbook (QRH) contains a DUAL BLEED FAULT procedure which was suitable for the events on this flight after the completion of the ECAM actions. When the ECAM identifies a fault, the system, as per its design, automatically shows the appropriate electronic checklist on the ECAM display. However, if one bleed air system is already inoperative prior to the flight the electronic fault monitoring system does not function in the abovementioned fashion when there is a bleed fault. If a fault occurs the flight crew must know the correct order in which to read the procedure and complete the actions. They also must be able to select the correct procedure from the QRH. In addition to reading the procedure the pilots must also properly control the aircraft, handle radiocommunications with the air traffic control, instruct the cabin crew regarding the situation and perform the required cabin announcements. According to the division of duties between the pilots, the PF will fly the aircraft and handle the navigation and radiocommunications while the co-pilot focuses on managing the fault. To increase awareness and aid decision making for the crew in the context of a dual bleed loss, Airbus has promised that the Company is going to incorporate a new ECAM “AIR ENG 1+2 BLEED FAULT” taking advantage of a next release of Flight Warning Computer, FWC.

Once the situation stabilised the flight crew should have supplemented their actions by starting the APU as a backup system for cabin pressurisation. An analysis of the situation shows the added value that the APU can bring to flight safety. The APU can be started at any altitude and its bleed air supply can cover the aircraft's pressurisation

10

requirements up to 20000 ft. This being the case, the highest safe altitude without engine bleed air is FL 200, rather than FL 100. Moreover, should yet another emergency descent become necessary, the passengers would not be subjected to such great pressure altitude changes. The temperature of the operative bleed air system climbed very close to its maximum value during the last 20 minutes of level flight before the flight crew left the cruising altitude for an approach. At that time the probability of one more emergency descent was high.

When an in-flight depressurisation occurs, the flight crew should broadcast the international distress call "MAYDAY" (recommendation: three times) on the frequency in use at the time. In addition, the message should contain the name of the station addressed, their own callsign, the nature of the emergency, the number of persons on board and the captain's intentions as well as their position, level and heading. As a result, the appropriate ATC unit will immediately begin to direct other traffic away from the intended route of the emergency aircraft. The ATC unit will take into account the fact that the aircraft is unable to execute climbing avoidance manoeuvres even if the Traffic Collision Avoiding System (TCAS) so advises. In addition, the ATC unit will alert the aerodrome of destination and the alternate aerodrome as well as any other rescue authorities along the route of the aircraft. The use of the distress call MAYDAY is laid down in ICAO Annex 10 Vol. II Radiotelephony Procedures, PANS-ATM Doc 4444 and Regional Supplementary Procedures Doc 7030. When flight crews comply with said procedures, Air Traffic Services and other aircraft are able to correctly understand these kinds of occurrences and properly respond to them.

The pilot-in-command used his own discretion when he contacted Malmö ATCC and decided not to declare an emergency, because the reason for the depressurisation was so obvious. His decision may have been affected by the fact that flight AY831 was already cleared to descend to FL 100 when they received the cabin pressure warning. The investigators want to highlight the fact that even if the causes of an atypical situation seem logical, an unlikely chain of events may conceal the root cause. It is important to keep the threshold for declaring an emergency as low as possible. An emergency can always be cancelled if it turns out to be disproportionate to the situation. The purpose of the legal and operational status of a declared emergency is to maximise the safety of aviation. The purpose of a MAYDAY call is to inform all possible parties, the air traffic control and any nearby aircraft of an occurrence that jeopardizes the safety of aviation.

The aircraft manufacturer uses the phrase 'rapid descent' in its QRH. However, the investigators prefer the phrase 'emergency descent', which they believe to be a more descriptive expression. In both instances the flight procedures are more or less identical. The intention is to make the aircraft rapidly descend with its maximum vertical speed. But only the term 'emergency descent' includes a functional instruction for the air traffic control as well. An aircraft descending from above its safe altitude, suffering from in-flight depressurisation, cannot follow TCAS resolution advisories which entail climbing. Even in this occurrence a declared emergency would have compelled the ATC to use different methods, had there been lots of other traffic below the affected aircraft's route. The flight crew did not squawk 7700 because Malmö ATCC was informed of the state of events. The pilots had received emergency descent refresher training during simulator training sessions which took place approximately a year and half before the occurrence flight. An emergency descent is such a demanding situation that one has to regularly train for it in a simulator. It is the opinion of the investigators that pilots should also practice declaring an emergency.

11

2.1.3 Functioning of the Cockpit Voice Recorder

According to ICAO Annex 6, aircraft shall be equipped with a CVR with a minimum recording duration of two hours, which, in practice, has also become the industry maximum standard. Annex 6 says that the recorder shall not be switched off during flight time. It also states that the operator is responsible for preserving the recordings pending a safety investigation. The investigators believe that the present two hour-requirement no longer corresponds to the needs of safety investigation. Modern technology could easily, and substantially, lengthen the recording capacity. A more detailed analysis of the topic is included in a related recommendation issued to the EASA in Investigation Report C11/2010L, published by the Safety Investigation Authority, Finland.

As the CVR recording only contained aural information for the two hours prior to the recorder being switched off, it was impossible to ascertain whether the correct checklists were read in the correct order. In this occurrence the device was switched off and the recording preserved at the destination in London, more than two hours after the occurrence. Hence, the recording no longer contained the cockpit conversations from the time of the occurrence.

2.2 Technical maintenance

Advances in aviation technology increasingly provide digital technology-based upgrades for equipment. New devices often store memory files which contain plenty of usefull information. For example, the engine bleed air system contains a Bleed Monitoring Computer (BMC). The BMC records system information which is, especially, intended for post-flight troubleshooting. Error files which do not affect to the continuous airworthinerss or the operation of the aircraft, are regularly reviewed in connection with the A –Checks (750h/6 months).

12

3 CONCLUSIONS

3.1 Findings

1. The flight crew of flight AY831 had valid licences and the required ratings.

2. The airworthiness certificate of the OH-LXL was valid.

3. The scheduled maintenance of the OH-LXL had been done in accordance with the regulations.

4. Only one engine's bleed air system was operative when the aircraft departed on the occurrence flight. The faulty system had been transferred to the Hold Item List in accordance with regulations.

5. The Hold Item List did not contain any other entries which could have affected the operation of engine bleed air systems.

6. The OH-LXL was airworthy at departure.

7. The only engine bleed air system that had been functioning failed in flight. As a result of this, the cabin depressurised and cabin pressure altitude began to climb.

8. The flight crew did not start the Auxiliary Power Unit (APU) eventhought the Bleed recovery was not complete.

9. Flight AY831 had to make an emergency descent to a safe altitude.

10. Once the failed bleed air system cooled it was restarted and the flight to London, the destination, was continued at an altitude lower than the one in the flight plan.

11. Since the CVR recording capacity was only two hours, it no longer contained the data from the time of the occurrence for the investigation because the flight time after the occurrence exceeded two hours. The interval between the incident and the aircraft parking was 2 h 13 min.

12. The flight crew participated in the post-flight defusing session.

13. The captain and the air traffic controller at Malmö ATCC filed their respective Air Safety Reports (ASR).

14. The occurrence was classified as a serious incident because the flight crew donned their emergency oxygen masks.

3.2 Probable cause

The serious incident on the OH-LXL was caused by rising Cabin Pressure which, in turn, could have been the result of a failure of the Fan Air Valve (FAV) or Temperature Control Thermostate (TCT) grid filter clogging in the right engine's bleed air system (Bleed No2).

With the other system being inoperative for flight, the cooling capacity of only one system proved insufficient. The pre-cooled air was too hot, therefore the temperature sensor of the system worked as per its design and shut off the overheated system.

13

4 SAFETY RECOMMENDATIONS

4.1 Safety actions planned or already implemented

From the standpoint of the investigation the most important safety improvement measure involved Finnair's internal campaign to expedite the modification of certain non-time limited engine bleed air system components.

In the aftermath of the serious incident that occurred on 5 March 2011, Finnair Airbus group management issued instructions to the Network Control Center (NCC) according to which Finnair's A320 aircraft were not to be flown over the Alps if the aircraft had only one operative bleed air system.

At the time of the event, the Airbus MMEL was erroneously referring, for crew awareness, to the OEB 203 in case of second bleed loss. The MMEL was corrected at the revision published in 25th March 2011.

Airbus will modify the MMEL 36-11-01 operational procedure to detail the crew actions without referring to the OEB. (Target date 1Q 2013)

To increase awareness and aid decision making for the crew in the context of dual bleed loss, Airbus activities are ongoing to incorporate a new ECAM “AIR ENG 1+2 BLEED FAULT” taking advantage of a next release of FWC.

4.2 Safety recommendations

1. It must be possible to display the bleed air system emergency instructions on the ECAM. Currently the flight crew has to read procedures from the MEL, the OEB and the QRH. The present-style scattered instructions do not enhance aviation safety.

The Safety Investigation Authority, Finland recommends that the EASA oblige Airbus S.A.S. to compile all engine bleed air failure-related emergency procedures that pilots use, and display the complete set of instructions on the ECAM.

2. The aircraft manufacturer's Operations Engineering Bulletin (OEB) contains flight crew procedures for a bleed air system fault if one or both systems fail. It contains the instructions for reducing stress to the single operative system by means of actions prior to the departure as well as those for the procedure during an in-flight failure.

The Safety Investigation Authority, Finland recommends that the EASA oblige Airbus S.A.S. to amend the OEB in a manner that clearly segregates the procedures for prior to the flight and during the flight. Additionally Airbus S.A.S. needs to assure that all the appropriate actions included in the OEB are in line with QRH.

14

4.3 Other observations and proposals

1. The Cockpit Voice Recorder is required to store the voice data for the last two (2) hours of flight, at minimum. The minimum capacity determined for CVRs is widely used as the industry norm even though, from the standpoint of safety investigation, it would be of utmost importance to have access to aural information from the entire flight. SIA Investigation Report C11/2010L issued a safety recommendation related to this issue, which also includes a more detailed analysis on the topic.

2. During the autumn 2009 simulator training session the pilots of flight AY831 had practiced emergency descents. The investigators consider it sensible to also practice declaring an emergency, so as to lower the functional threshold for doing so.

3. The aircraft manufacturer's Quick Reference Handbook (QRH) for flight crews repeatedly uses the expression 'descend rapidly' in the context of in-flight depressurisation. Said phrase may lead flight crews to believe that the situation does not entail an emergency. However, aircraft depressurisation is always an emergency and flight crews should use the phrase 'emergency descent' in their transmissions.

Appendix 1 1(1)

SUMMARY OF THE RECEIVED COMMENTS ON THE DRAFT FINAL REPORT

FINNISH TRANSPORTATION SAFETY AGENCY – TRAFI

Transportation Safety Agency did not have any comments on the report. FINNAIR PLC

In its comments Finnair states that Technical Maintenance is incorrectly described in the report and that some unneseccasry component replacements were accomplished. Finnair emphasizes that no unneseccasry component replacements were accomplished. The text of the report was rephrased without changing the meaning of the content. EUROPEAN AVIATION SAFETY AGENCY – EASA

EASA requests in its comments that if possible, the time at which the aircraft was stopped at its parking stand in London, would be established in the report. This accuracy relates to follow-up research initiated by EASA for to collect cases of CVR overruns with two-hours-recording duration CVRs. The time was added in the report, and annexis 2 and 3 were established to present the OEB and QRH instructions related flight crew procedures for a bleed air system fault if one or both systems fail.

EASA agrees on the Safety Recommendation 4.2.2 addressed to Airbus S.A.S. related to OEB Bulletin. According to EASA’s proposal the following was added to the report to enhance the effectiveness of the Safety Recommendation: "Additionally Airbus S.A.S. needs to assure that all the appropriate actions included in the OEB are in line with QRH." AIRBUS INDUSTRIES Airbus S.A.S. Industries commented widely on the report. Constructive and focusing comments were taken into account on the report without changing the meaning of the content. FRENCH AIR ACCIDENT INVESTIGATION AUTHORITY (BUREAU D’ENQUETES ET D’ANALYSES POUR LA SECURITE DE L’AVIATION CIVILE) – BEA French Accident Investigation Authority commented on the report by accepting the comments prepared by Airbus S.A.S. SWEDISH ACCIDENT INVESTIGATION BOARD (STATENS HAVERIKOMMISSION – SHK) Accident Investigation Board Sweden did not have any comments on the report.

Appendix 2 1(5)

EXTRACT FROM AIRBUS’S OPERATIONS ENGINEERING BULLETIN (OEB) REF. 203 / 1 MAR 10

Appendix 2 2(5)

Appendix 2 3(5)

Appendix 2 4(5)

Appendix 2 5(5)

Appendix 3 1(2)

EXTRACT OF AIRBUS’S QRH PAGE 2.02 AND 2.02A ON AIR DUAL BLEED FAULT

Appendix 3 2(2)